From 3ef8fbe2e3509640a5d4a281a745606e91f0b81a Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Wed, 8 Aug 2007 22:29:13 +0000
Subject: [PATCH] - Modified failregex again. Thanks to Yaroslav Halchenko

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@609 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/sshd.conf | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 98b5ceae..316af802 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,11 +14,11 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .+ from <HOST>(?: port \d+ ssh2)?$
-            Failed [-/\w]+ for .+ from <HOST>(?: port \d+ ssh2)?$
-            ROOT LOGIN REFUSED .+ FROM <HOST>(?: port \d+ ssh2)?$
-            [iI](?:llegal|nvalid) user .+ from <HOST>(?: port \d+ ssh2)?$
-            User .+ from <HOST> not allowed because not listed in AllowUsers$
+failregex = (?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+            Failed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
+            ROOT LOGIN REFUSED.* FROM <HOST>\s*$
+            [iI](?:llegal|nvalid) user .* from <HOST>\s*$
+            User \S+ from <HOST> not allowed because not listed in AllowUsers$
             User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$
 
 # Option:  ignoreregex